Question 1

How long does an engagement actually take?

Accepted Answer

The Audit is two weeks of active work — week one is discovery, week two is the security review and written deliverables — plus 30 days of email support after we hand over. The Roadmap uses the full 8-week cadence (discovery, audit, build, handoff). Embedded is monthly with a three-month minimum.

Question 2

Do you work with companies outside the US?

Accepted Answer

Yes. Most of our work is remote-first. We handle clients across English-speaking markets without time-zone drama.

Question 3

Is my industry too regulated for this?

Accepted Answer

Probably not. We've designed our process to fit healthcare, finance, and law firms. We're explicit about what we can and can't do; see our security and data-handling policy under Terms.

Question 4

What if I need to pause the engagement?

Accepted Answer

Embedded engagements can pause once per 12 months for up to 30 days. Audit and Roadmap are fixed-scope, so we deliver them in one continuous push.

Question 5

How does pricing work?

Accepted Answer

We price by engagement type — Audit (fixed scope), Roadmap (fixed scope), and Embedded (monthly with a 3-month minimum). No per-seat charges and no surprise upsells. We share specific numbers for your situation on the free 30-minute assessment so the scope and price match what you actually need.

Question 6

What if our needs change mid-engagement?

Accepted Answer

It happens. Most clients start with Audit and roll into Roadmap once the gaps are visible. If scope changes mid-flight, we pause, talk it through, and re-quote — no claw-backs, no surprise add-ons. You always own what's been delivered.

Question 7

How much time does my team need to commit?

Accepted Answer

Five to ten hours per week from your ops lead and one technical contact. We handle roughly 80% of the implementation work.

Question 8

How do you measure success?

Accepted Answer

Each engagement defines 2–3 KPIs in week one (cost saved, hours returned, risk reduced) and we track them through delivery. If we're not on track by week three, we re-scope or refund the second half.

Question 9

Who owns the deliverables?

Accepted Answer

You do. Every policy doc, automation, and report is yours forever. We don't build vendor lock-in.

Question 10

Is ChatGPT safe for my business?

Accepted Answer

It depends on what data your team puts into it. Free ChatGPT trains on your inputs by default; that's a real problem if you handle client data, internal financials, or anything contractually confidential. We'll tell you exactly which tools to use, which to ban, and how to make the rule stick. That's most of what an Audit covers.

Question 11

What's the difference between AI security and regular IT security?

Accepted Answer

Regular IT security defends your endpoints, network, and identities. AI security adds three new attack surfaces: data leakage into models, model behavior manipulation, and outputs you can't fully predict. Most IT teams haven't been trained on the new surfaces yet. That's the gap we close.

Question 12

Will you sign an NDA?

Accepted Answer

Yes. We sign before any sensitive conversation. Reciprocal NDAs only; we won't sign one-way agreements.

Question 13

What if your audit finds something we don't want made public?

Accepted Answer

Everything we find is yours. Our reports go to you and stay with you. We never publish identifiable client information, ever.

Question 14

Why no testimonials on the site?

Accepted Answer

We're new. We'd rather show you our process than fake social proof. Once we have engagements with permission to share, you'll see real names and metrics here, not anonymous quotes.

Questions, plainly answered.

About engagements

About AI security

About working with us

Stop guessing about AI risk. Start measuring it.